CVE-2023-27532 - Veeam Backup & Replication - Credential Disclosure 💰

[princechaddha]

Description:

Veeam Backup & Replication allows encrypted credentials stored in the configuration database to be obtained by attackers who can access backup infrastructure hosts.

Severity: High (CVSS: 7.5)

Vulnerability Details:

• CVE ID: CVE-2023-27532
• CWE: CWE-306 (Missing Authentication for Critical Function)
• Affected Versions: 11.0.1.1261 and 12.0.0.1420
• Attack Vector: Network
• Authentication: Requires access to configuration database
• Impact: Information Disclosure, Privilege Escalation

POC:

• https://github.com/horizon3ai/CVE-2023-27532
• https://github.com/sfewer-r7/CVE-2023-27532
• https://github.com/puckiestyle/CVE-2023-27532-RCE-Only

KEV: True ✅

CISA KEV: Added 2023-08-22
Known Ransomware Campaign: Yes (Akira, Qilin, and multiple others)

EPSS Score: 0.87024 (99.406th percentile) ⚠️

Shodan Query: "Veeam Backup" http.title:"Veeam Backup Enterprise Manager"

---

Acceptance Criteria:
The template must include a complete POC and should not rely solely on version-based detection. Contributors must share vulnerable setup information or a testable instance by emailing templates@projectdiscovery.io. Providing a testable instance significantly reduces validation time and increases the chance of quicker rewards. Templates that are incomplete, invalid, or non-verifiable will not be accepted. Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only these are blocked by default and will not produce results. Exceptions may apply for certain cases. Do not submit AI-simulated vulnerable environments. To qualify for the bounty, the team must be able to fully validate the POC. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates[at]projectdiscovery.io

Note: This vulnerability has been actively exploited in multiple ransomware campaigns including Akira, Qilin, and others. VERY HIGH PRIORITY - EPSS score 0.87 (top 1%).

---

References:

• https://www.veeam.com/kb4424
• https://github.com/horizon3ai/CVE-2023-27532
• https://www.zscaler.com/resources/industry-reports/threatlabz-2025-ransomware-analysis.pdf
• https://blog.qualys.com/vulnerabilities-threat-research/2025/06/18/qilin-ransomware-explained-threats-risks-defenses
• https://services.google.com/fh/files/misc/m-trends-2025-en.pdf

You can check the FAQ for the Nuclei Templates Community Rewards Program here

[princechaddha]

/bounty $200

[algora-pbc]

💎 $200 bounty • ProjectDiscovery Bounty Available for CVE Template Contribution

Steps to Contribute:

• Claim attempt: Comment /attempt #13435 on this issue to claim attempt. Multiple participants can attempt, but only the first to submit a complete POC template along with full debug data will receive the reward similar to bug bounty programs.
• Write the Template: Create a high-quality Nuclei template for the specified CVE, following our Contribution Guidelines and Acceptance Criteria.
• Submit the Template: Open a pull request (PR) to projectdiscovery/nuclei-templates and include /claim #13435 in the PR body to claim the bounty.
• Receive Payment: Upon successful merge of your PR, you will receive 100% of the bounty through Algora.io within 2-5 days. Ensure you are eligible for payouts.

Thank you for contributing to projectdiscovery/nuclei-templates and helping us democratize security!

Acceptance Criteria: The template must include a complete POC and should not rely solely on version-based detection. Contributors must share vulnerable setup information or a testable instance by emailing templates@projectdiscovery.io. Providing a testable instance significantly reduces validation time and increases the chance of quicker rewards. Templates that are incomplete, invalid, or non-verifiable will not be accepted. Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only these are blocked by default and will not produce results. Exceptions may apply for certain cases. Do not submit AI-simulated vulnerable environments. To qualify for the bounty, the team must be able to fully validate the POC. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates[at]projectdiscovery.io

You can check the FAQ for the Nuclei Templates Community Rewards Program here.

Add a bounty • Share on socials

Attempt	Started (UTC)	Solution	Actions
🟢 @SaikiranSurapalli17	Oct 02, 2025, 06:02:04 AM	WIP
🟢 @naaa760	Oct 02, 2025, 10:01:09 AM	#13460	Reward

[SaikiranSurapalli17]

/attempt #13435

[naaa760]

/attempt #13435